// Case studies
It already happened.
Prompt injection against an agent that holds money is not a hypothetical. These are documented incidents with named parties, transaction hashes, and third-party analysis. Each page states what happened, what the root cause was according to the people who investigated it, and — plainly — which control applies and which does not. One of them self-replicated; the others did not, and the distinction still matters.
Incidents
An evolutionary algorithm produced payloads that spread agent-to-agent through ordinary conversation, write themselves into the file re-injected into the system prompt, and survive a context wipe. The destructive ones spread best: an rm -rf payload reached 85%.
A self-propagating worm poisoned hundreds of packages in under four hours, harvested agent credentials alongside cloud keys, and committed a SessionStart hook into .claude/settings.json so the payload outlives the dependency that delivered it.
A Morse-encoded instruction in an X post. Grok decoded it, re-emitted it publicly, and tagged the payment bot. The bot treated another AI's public output as authorisation to move funds.
No injected file, no compromised dependency. A player convinced an agent it had entered an admin context and that its own transfer approval meant the opposite of what it meant.
The pattern
Read the two payment incidents side by side — Grok/Bankr and Freysa — and the same shape appears in both. In neither case was a contract exploited, a key stolen, or a signature forged. In both, the agent did exactly what it was told, by text that arrived from somewhere nobody had decided to trust and that no independent channel ever corroborated.
This is why content scanning alone cannot be the answer. A rule that matches an injected phrase is matching an attacker’s wording, and wording is the cheapest thing in the attack to change. The control that holds is structural: compare the payment the agent is about to sign against the quote the merchant independently issued, on a channel the model never touched. If the two disagree, refuse — regardless of how convincing the instruction was.
The lie lands; the damage does not. Injection succeeding and theft succeeding are separate events, and only the second one costs money.
ChainDrop is the counterexample that completes the picture. Nobody talked its way past a model — it ran code, took secrets, and copied itself. What it shares with the other two is where it ended up: inside the files an agent loads without being asked. The lesson is that agent tooling is now worth attacking through the model and around it, and the controls for those are different.
Which of these was a worm
Worth separating carefully, because this site is named after the escalation and it would be easy to blur the categories in our own favour. Bankr/Grok and Freysa are prompt injection — Bankr said so in as many words, and SlowMist analysed it as such. Neither self-replicated. No compromised agent went on to infect the next one; the attacker had to show up for each attempt.
ChainDrop is the opposite case. It genuinely self-replicated — stolen tokens republished it across hundreds of packages with no attacker in the loop — and it persisted through agent configuration, following Miasma’s use of the same mechanic across 73 repositories in June 2026. But no model was injected and no agent was persuaded of anything. It is ordinary malware that happened to pick agent tooling as a good place to hide.
So the two halves now both exist in the wild, separately: injection that moves money, and payloads that copy themselves through agent config. What still has not happened, as far as any public record shows, is one payload doing both — self-replicating and talking an agent into a payment. ChainDrop stole wallet files, but it stole them the way it stole SSH keys. Describing the join as already routine would be the same overclaim these pages exist to avoid.
The reason to put a guard in the payment path before that join happens is that it is cheap for an attacker and expensive for everyone else — and a control that only works once the attack is common is not a control.
Related research
SEO-poisoned packages and typosquatted finance sites. Of 26 models tested, four executed crypto payments from indirect injection alone.
Academic framing of the escalation path from injected text to agent-executed malware (arXiv 2601.09625).
A note on sourcing
Every figure on these pages is attributed, and where reporting disagrees the range is given rather than a single convenient number. Where a detail appears in only one outlet it is marked as such. This matters more than usual here: a security tool whose case studies do not survive a fact-check has argued against itself.